CVE-2021-3007
CRITICAL EXPLOITED IN THE WILD NUCLEILaminas Project laminas-http <2.14.2 - Code Injection
Title source: llmExploitation Summary
CVE-2021-3007 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 3 public exploits from researchers including Vulnmachines, KrE80r, yunus-a1i. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional PHP deserialization exploit for CVE-2021-3007, targeting Zend Framework 3. It constructs a malicious serialized payload using Zend classes to achieve remote code execution (RCE) via the `system` and `phpinfo` functions.
Description
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
Exploits (3)
This repository contains a functional PHP deserialization exploit for CVE-2021-3007, targeting Zend Framework 3. It constructs a malicious serialized payload using Zend classes to achieve remote code execution (RCE) via the `system` and `phpinfo` functions.
This repository provides a fully functional vulnerable test environment for CVE-2021-3007, an insecure deserialization vulnerability in Laminas/Zend Framework. It includes a Dockerized setup with a vulnerable PHP application that accepts and deserializes untrusted input, along with a pre-constructed payload for testing RCE.
This repository contains a functional exploit for CVE-2021-3007, a PHP deserialization vulnerability in Laminas/Zend HTTP. It includes a Dockerized vulnerable environment, a standalone exploit script, and a Nuclei template for automated testing.
Nuclei Templates (1)
http.html:"laminas"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H